The WP AutoKeyword plugin has a missing‑authorization flaw that lets an attacker delete arbitrary content from the WordPress site. An exploit would allow removal of posts, pages or custom post types, resulting in data loss and disruption of service. The weakness is a classic access‑control violation (CWE‑862).

The flaw exists in the WP AutoKeyword plugin version 1.0 and earlier, as developed by EXEIdeas International. Any WordPress installation that has the plugin installed at these versions is affected; the listing covers all variants of the plugin up to 1.0.

The CVSS score of 5.4 indicates moderate impact. The EPSS score of less than 1 % suggests a very low probability of exploitation in the wild, and the vulnerability is not currently catalogued in the CISA KEV list. The likely attack vector involves an attacker who has authenticated administrative access or falls under incorrectly configured roles. In such a scenario, the missing authorization flaw could be exploited to delete content. Administrators should act promptly to mitigate the risk by updating the plugin or disabling it.